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AMENDMENTS TO THE CLAIMS 

1. (Canceled) 

2. (Currently Amended) The method recited in claim 452, wherein the one or more 
states are specified based on thresholds. 

3. (Currently Amended) The method recited in claim 4-52, wherein the notification is an 

event. 

4. (Currently Amended) The method recited in claim 452, wherein the particular 
component or interaction between the particular two or more components is a component, 
and wherein the step of generating the notification comprises generating the notification by 
the component. 

5. (Currently Amended) The method recited in claim 452, wherein the particular 
component or interaction between the particular two or more components is an interaction 
between the particular two or more components, and wherein the notification is generated by 
at least one of the particular two or more components. 

6. (Currently Amended) The method recited in claim 452, further comprising the step 
of: 

reporting the notification to a network management system. 

7. (Canceled) 

8. (Currently Amended) The method recited in claim 7-52, wherein, the step of detecting 
is performed by an agent, said agent being different than the particular component. 

9. (Canceled) 
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10. (Currently Amended) The method recited in claim i-52, further wherein monitoring 
the condition associated with the particular component or interaction between the two or 



wherein querying the state table is based at least upon the value for the Management 
Information Base object . 

11-14. (Canceled) 

15. (Currently Amended) The method recited in claim 4852, wherein the set of one or 
more illegal states or state transitions comprises a state associated with an authorization 
violation or an authentication forgery . 

16. (Currently Amended) The method recited in claim 4852, wherein the set of one or 
more undesirable states or state transitions comprises a state associated with a sudden quality 
of service degradation or a violation of a service level agreement. 

17. (Currently Amended) The method recited in claim 4-52, further comprising the step of 
examining multiple notifications to deduce one or more trends regarding the network. 

18. (Previously presented) The method recited in claim 17, wherein the step of examining 
multiple notifications comprises examining notifications for stable-behavior in a threshold 
value for a particular trend. 

19. (Previously presented) The method recited in claim 17, wherein the step of examining 
multiple notifications comprises examining notifications for increases or decreases in a 
threshold value for a particular trend. 

20. (Currently Amended) A computer-based system for capturing behavior for network 
components and for interactions between components, the system comprising: 




polling a value for an Management Information Base object at the particular 

component or the particular two or more components to determine thi 
particular state or state transition has occurred^ 
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one or more network components, each network component configured to 
spontaneously generate notifications when specified states and state 
transitions occur involving the network component, 

wherein the specified state and state transitions include one or more composite 
state transitions, each of said composite state transition comprising 
multiple state transitions; and 
a network management system configured to receive said spontaneously generated 

notifications; 

wherein each network component is further configured to: 

access first data that defines the specified states and state transitions involving 

the netwoi'k component, 

wherein the first data defines at least one composite state transition, 
each of said composite state transition comprising multiple 
state transitions; 

access second data that indicates, for the network component or an interaction 
between the network component and another network component, a set 
of one or more undesirable states or state transitions; 
wherein each of said one or more undesirable states or state transitions 
is a state or state transition of the specified states and state 
transitions that is associated with undesirable behavior; and 
access third data that indicates, for the network component or the interaction, 
a set of one or more illegal states or state transitions; 
wherein each of said one or more illegal states or state transitions is a 
state or state transition of the specified states and state 
transitions that is associated with illegal behavior; 
wherein the set of one or more illegal states or state transitions is 

different from the set of one or more undesirable states or state 
transitions; 

detect that a particular state or state transition has occurred at the network 

component or the interaction, wherein the step of detecting comprises: 
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monitoring a condition associated with the network component or the 

interaction; 

querying a state table storing said first data to determine the particular 
state or state transition for the network component or the 
interaction; 

determining, based on the second data and third data, that the 

particular state or state transition belongs to either the set of 
one or more undesirable states or state transitions or the set of 
one or more illegal states or state transitions; 
in response to detecting that the particular state or state transition has occurred 

at the network component or interaction has entered, generating a 

notification corresponding to the particular state or state transition. 

wherein the particular state or state transition is one of the one or more 
states and state transitions; 

wherein the particular state or state transition belongs to either the set 
of one or more undesirable states or state transitions or the set 
of one or more illegal states or state transitions . 

21 . (Original) The system of claim 20, further comprising: 

an agent configured to detect the generation of notifications by the network 

components, and configured to report detected notifications to said network 
management system. 

22. (Canceled) 

23. (Currently Amended) The system of claim 3220, wherein the state table is in a-the 

network management system. 

24. (Currently Amended) The system of claim 3220, wherein the state table is in one of 
the one or more network components. 

25. (Canceled) 
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26. (Canceled) 

27. (Currently Amended) A computer-based system for capturing illegal and unde sired 
undesirable b ehavior for network components and for interactions between components 
comprising: 

one or more network components; 

an agent configured to examine said network components to determine whether 

specified states or state transitions, including composite state transitions, have 
occuiTed, 

wherein the agent is configured to generate notifications upon a determination 
that a specified state or state transition has occurred; 

wherein the agent is configured to report detected notifications to a network 
management system; 

wherein each of said composite state transition comprises multiple state 
transitions; 

wherein the specified states and state transitions comprise (1) a set of 

undesirable states or state transitions associated with undesirable 
behavior and (2) a set of illegal states or state transitions associated 
with illegal behavior, said set of illegal states and state transitions 
being different than said set of undesirable states or state transitions; 

said network management system configured to receive reports of said generated 

notifications^ 
wherein the agent is further configured to: 

access first data that defines the specified states and state transitions involving 
a network component. 

wherein the first data defines at least one composite state transition, 
each of said composite state transition comprising multiple 
state transitions; 
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access second data that indicates, for the network component or an interaction 
between the network component and another network component, a set 
of one or more undesu'able states or state transitions; 
wherein each of said one or more undesirable states or state transitions 
is a state or state transition of the specified states and state 
transitions that is associated with undesirable behavior; and 
access third data that indicates, for the network component or the interaction, 
a set of one or more illegal states or state transitions; 
wherein each of said one or more illegal states or state transitions is a 
state or state transition of the specified states and state 
transitions that is associated with illegal behavior; 
wherein the set of one or more illegal states or state transitions is 

different from the set of one or more undesirable states or state 
transitions; 

detect that a particular state or state transition has occurred at the network 

component or the interaction, wherein the step of detecting comprises: 
monitoring a condition associated with the network component or the 
interaction; 

querying a state table storing said first data to determine the particular 
state or state transition for the network component or the 
interaction; 

determining, based on the second data and third data, that the 

particular state or state transition belongs to either the set of 
one or more undesirable states or state transitions or the set of 
one or more illegal states or state transitions; 
in response to detecting that particular state or state transition has occurred at 

the network component or the interaction, generating one of said 

notifications, the one of said notifications corresponding to the 

particular state or state transition. 
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wherein the particular state or state transition is one of the specified 

states and state transitions: 
wherein the particular state or state transition belongs to either the set 
of one or more undesirable states or state transitions or the set 
of one or more illegal states or state transitions . 

28. (Canceled) 

29. (Canceled) 

30. (Currently Amended) The computer-readable storage medium as recited in Claim 
3957, wherein the one or more states are specified based on thresholds. 

3 1 . (Currently Amended) The computer-readable storage medium as recited in Claim 
3957, wherein said notifications are events. 

32. (Currently Amended) The computer-readable storage medium as recited in Claim 
3957, wherein the particular component or interaction between the particular two or more 
components is a component, and wherein the step of generating the notification comprises 
generating the notification by the component. 

33. (CuiTcntly Amended) The computer-readable storage medium as recited in Claim 
3957, wherein the particular component or interaction between the particular two or more 
components is an interaction between the particular two or more components, and wherein 
the notification is generated by at least one of the particular two or more components. 

34. (Curtently Amended) The computer-readable storage medium as recited in Claim 
3957, wherein the one or more sequences of instructions for carrying out the step of creating 
and storing first information further comprise instructions for carrying , when executed by 
one or more processors, further cause the one or more processors to carry out the step of: 

reporting the notification to a network management system. 

35. (Canceled) 
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36. (Currently Amended) The computer-readable storage medium as recited in Claim 
^57. wherein the step of detecting is performed by an agent, said agent being different than 
the particular component. 

37. (Canceled) 

38. (Currently Amended) The computer-readable storage medium as recited in Claim 
3957, wherein the one or more sequences of instructions for carrying out the step of creating 
and storing first information further comprise instructions for carrying . when executed by 
one or more processors, further cause the one or more processors to carry out the step of: 

polling a value for an Management Information Base object at the particular 

component or the particular two or more components to determine that the 
particular state or state transition has occuiTed 

wherein querying the state table is based at least upon the value for the Management 
Information Base object . 

39-42. (Canceled) 

43. (CuiTently Amended) The computer-readable storage medium as recited in Claim 
§457, wherein the set of one or more illegal states or state transitions comprises a state 
associated with an authorization violation or an authentication forgery . 

44. (Currently Amended) The computer-readable storage medium as recited in Claim 
#457, wherein the set of one or more undesirable states or state transitions comprises a state 
associated with a sudden quality of service degradation or a violation of a service level 

agreement. 

45. (Currently Amended) The computer-readable storage medium as recited in Claim 
3957, wherein the one or more sequences of instructions for carrying out the step of creating 

and storing first information further comprise instinctions for cairying . when executed by 
one or more processors, further cause the one or more processors to carry out the step of 
examining multiple notifications to deduce one or more trends regarding the network. 
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46. (Previously presented) The computer-readable storage medium as recited in Claim 
45, wherein the step of examining multiple notifications comprises examining notifications 
for stable-behavior in a threshold value for a particular trend. 

47. (Previously presented) The computer-readable storage medium as recited in Claim 
45, wherein the step of examining multiple notifications comprises examining notifications 
for increases or decreases in a threshold value for a particular trend. 

48. (Canceled) 

49. (Canceled) 

50. (Currently Amended) The method recited in claim 4-52, wherein the first data is stored 
in a state table in a network management system, wherein the step of generating is performed 
by a component or agent separate from the network management system. 

5 1 . (Currently Amended) The method recited in claim 4-52, wherein the first data is stored 
in a state table in the particular component or in at least one of the two or more particular 
components. 

52. (Currently Amended) A method for capturing behavior for network components and 
for interactions between components comprising: 

accessing first data that defines one or more states and state transitions for a particular 

component or interaction between a particular two or more components. 

wherein the first data defines at least one composite state transition, each of 
said composite state transition comprising multiple state transitions; 
accessing second data that indicates, for the particular component or interaction 

between the particular two or more components, a set of one or more 

undesirable states or state transitions: 

wherein each of said one or more undesirable states or state transitions is a 
state or state transition of the one or more states and state transitions 
that is associated with undesirable behavior: 
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accessing third data that indicates, for the particular component or interaction 

between the particular two or more components, a set of one or more illegal 

states or state transitions; 

wherein each of said one or more illegal states or state transitions is a state or 

state transition of the one or more states and state transitions that is 

associated with illegal behavior; 
wherein the set of one or more illegal states or state transitions is different 

from the set of one or more undesirable states or state transitions; and 
in response to the particular component or interaction between the particular two or 
more components entering a particular state or state transition, generating a 
notification corresponding to the particular state or state transition, 
wherein the particular state or state transition is one of the one or more states 

and state transitions; 
wherein the particular state or state transition belongs to either the set of one 

or more undesirable states or state transitions or the set of one or more 

illegal states or state transitions: 
i%e- the method recited in claim 4 8, further comprising: 

detecting that the particular component or interaction between the particular 

two or more components has entered the particular state or state 

transition; 

wherein said notification is generated in response to said step of detecting; 
wherein the step of detecting comprises: 

monitoring a condition associated with the particular component or 
interaction between the two or more particular components; 

querying a state table storing said first data to determine a state for the 

particular component or interaction between the two or more particular 
components; 

determining, based on the second data and third data, that the determined state 
belongs to either the set of one or more undesirable states or state 
transitions or the set of one or more illegal states or state transitions. 
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53. (Canceled) 

54. (Canceled) 

55. (Currently Amended) The computer- readable storage medium as recited in claim 
3957, wherein the first data is stored in a state table in a network management system, 
wherein the step of generating is performed by a component or agent separate from the 
network management system. 

56. (Currently Amended) The computer-readable storage medium as recited in claim 
3957, wherein the first data is stored in a state table in the particular component or in at least 
one of the two or more particular components. 

57. (Currently Amended) A computer-readable storage medium carrying one or more 
sequences of instructions for capturing behavior for network components and for interactions 
between components, which instmctions, when executed by one or more processors, cause 
the one or more processors to carry out the steps of: 

accessing first data that defines one or more states and state transitions for a particular 
component or interaction between a particular two or more components, 
wherein the first data defines at least one composite state transition, each of 
said composite state transition comprising multiple state transitions; 

accessing second data that indicates, for the particular component or interaction 
between the particular two or more components, a set of one or more 
undesirable states or state transitions: 

wherein each of said one or more undesirable states or state transitions is a 
state or state transition of the one or more states and state transitions 
that is associated with undesirable behavior: 
accessing third data that indicates, for the particular component or interaction 

between the particular two or more components, a set of one or more illegal 

states or state transitions: 
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wherein each of said one or more illegal states or state transitions is a state or 

state transition of the one or more states and state transitions that is 

associated with illegal behavior: 
wherein the set of one or more illegal states or state transitions is different 

from the set of one or more undesirable states or state transitions: and 
in response to the particular component or interaction between the particular two or 
more components entering a particular state or state transition, generating a 
notification corresponding to the particular state or state transition, 
wherein the particular state or state transition is one of the one or more states 

and state transitions: 
wherein the particular state or state transition belongs to either the set of one 

or more undesirable states or state transitions or the set of one or more 

illegal states or state transitions: 
The computer readable storage medium as recited in claim 5 4 , wherein the one or 

more sequences of instructions for carrying out the step of creating and storing 
first information further comprise instructions for carrying out the step of ^ 
when executed by one or more processors, further cause the one or more 
processors to carry out the step of : 

detecting that the particular component or interaction between the particular 
two or more components has entered the particular state or state 
transition; 

wherein said notification is generated in response to said step of detecting; 
wherein the step of detecting comprises: 

monitoring a condition associated with the particular component or 
interaction between the two or more particular components; 
querying a state table storing said first data to determine a state for the 

particular component or interaction between the two or more particular 
components; 
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determining, based on the second data and third data, that the determined state 
belongs to either the set of one or more undesirable states or state 
transitions or the set of one or more illegal states or state transitions. 

58. (Canceled) 

59. (New) The method of Claim 52, wherein the determined state transition is the 
particular state or state transition, and further wherein determining, based on the second data 
and third data, that the determined state belongs to either the set of one or more undesirable 
states or state transitions or the set of one or more illegal states or state transitions comprises: 

based on the second data, determining whether or not the determined state belongs to 
the set of one or more undesirable states or state transitions. 

60. (New) The method of Claim 52, wherein the determined state transition is the 
particular state or state transition, and further wherein determining, based on the second data 
and third data, that the determined state belongs to either the set of one or more undesirable 
states or state transitions or the set of one or more illegal states or state transitions comprises: 

based on the third data, determining whether or not the determined state belongs to 
the set of one or more illegal states or state transitions. 

61. (New) The method of Claim 52, wherein the state table further stores the second data 
and the third data. 

62. (New) A method for capturing behavior for network components and for interactions 
between components comprising: 

accessing first data that defines one or more states and state transitions for a particular 
component or interaction between a particular two or more components, 
wherein the first data defines at least one composite state transition, each of 
said composite state transition comprising multiple state transitions; 

accessing second data that indicates, for the particular component or interaction 
between the particular two or more components, a set of one or more 
undesirable states or state transitions; 
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wherein each of said one or more undesirable states or state transitions is a 
state or state transition of the one or more states and state transitions 
that is associated with undesirable behavior; 
accessing third data that indicates, for the particular component or interaction 

between the particular two or more components, a set of one or more illegal 

states or state transitions; 

wherein each of said one or more illegal states or state transitions is a state or 

state transition of the one or more states and state transitions that is 

associated with illegal behavior; 
wherein the set of one or more illegal states or state transitions is different 

from the set of one or moie undesirable states or state transitions; and 
in response to the particular component or interaction between the particular two or 
more components entering a particular state or state transition, generating a 
notification corresponding to the particular state or state transition, 
wherein the particular state or state transition is one of the one or more states 

and state transitions; 
wherein the particular state or state transition belongs to either the set of one 

or more undesirable states or state transitions or the set of one or more 

illegal states or state transitions; 
the method further comprising: 

detecting that the particular component or interaction between the particular 

two or more components has entered the particular state or state 

transition; 

wherein said notification is generated in response to said step of detecting; 
wherein the step of detecting comprises: 

monitoring a condition associated with the particular component or 
interaction between the two or more particular components; 
querying a state table storing said first data to determine a state transition for 
the particular component or interaction between the two or more 
particular components; and 
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determining, based on the second data and third data, that the determined state 
transition belongs to a particular set of one or more states or state 
transitions, the particular set of one or more states or state transitions 
being either the set of one or more undesirable states or state 
transitions or the set of one or more illegal states or state transitions. 

63. (New) The method recited in claim 62, wherein the determined state transition is a 
composite state transition, wherein the determined state transition is the particular state or 

state transition. 

64. (New) The method of Claim 63, wherein: 

the composite state transition comprises a first state transition and a second state 
transition; and 

neither the first state transition nor the second state transition is in the particular set of 
one or more states or state transitions. 

65. (New) A computer-readable storage medium carrying one or more sequences of 
instructions for capturing behavior for network components and for interactions between 
components, which instructions, when executed by one or more processors, cause the one or 
more processors to carry out the steps of: 

accessing first data that defines one or more states and state transitions for a particular 
component or interaction between a particular two or more components, 
wherein the first data defines at least one composite state transition, each of 
said composite state transition comprising multiple state transitions; 

accessing second data that indicates, for the particular component or interaction 
between the particular two or more components, a set of one or more 
undesirable states or state transitions; 

wherein each of said one or more undesirable states or state transitions is a 
state or state transition of the one or more states and state transitions 
that is associated with undesirable behavior; 
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accessing third data that indicates, for the particular component or interaction 

between the particular two or more components, a set of one or more illegal 
states or state transitions; 

wherein each of said one or more illegal states or state transitions is a state or 

state transition of the one or more states and state transitions that is 

associated with illegal behavior; 
wherein the set of one or more illegal states or state transitions is different 

from the set of one or more undesirable states or state transitions; and 
in response to the particular component or interaction between the particular two or 
more components entering a particular state or state transition, generating a 
notification corresponding to the particular state or state transition, 
wherein the particular state or state transition is one of the one or more states 

and state transitions; 
wherein the particular state or state transition belongs to either the set of one 

or more undesirable states or state transitions or the set of one or more 

illegal states or state transitions; 
wherein the one or more sequences of instructions, when executed by one or more 
processors, further cause the one or more processors to carry out the step of: 
detecting that the particular component or interaction between the particular 

two or more components has entered the particular state or state 

transition; 

wherein said notification is generated in response to said step of detecting; 
wherein the step of detecting comprises: 

monitoring a condition associated with the particular component or 
interaction between the two or more particular components; 
querying a state table storing said first data to determine a state transition for 
the particular component or interaction between the two or more 
particular components; and 
determining, based on the second data and third data, that the determined state 
transition belongs to a particular set of one or more states or state 
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transitions, the particular set of one or more states or state transitions 
being either the set of one or more undesirable states or state 
transitions or the set of one or more illegal states or state transitions. 

66. (New) The method recited in claim 65, wherein the determined state transition is a 
composite state transition, wherein the determined state transition is the particular state or 
state transition. 

67. (New) The method of Claim 66, wherein: 

the composite state transition comprises a first state transition and a second state 
transition; and 

neither the first state transition nor the second state transition belong to the particular 
set of one or more states or state transitions. 

68. (New) The computer-readable storage medium as recited in Claim 57, wherein 
determining, based on the second data and third data, that the determined state belongs to 
either the set of one or more undesirable states or state transitions or the set of one or more 
illegal states or state transitions comprises: 

based on the second data, detennining whether or not the determined state belongs to 
the set of one or more undesirable states or state transitions. 

69. (New) The computer-readable storage medium as recited in Claim 57, wherein 

determining, based on the second data and third data, that the determined state belongs to 
either the set of one or more undesirable states or state transitions or the set of one or more 
illegal states or state transitions comprises: 

based on the third data, determining whether or not the determined state belongs to 
the set of one or more illegal states or state transitions. 

70. (New) The computer-readable storage medium as recited in Claim 57, wherein the 
state table further stores the second data and the third data. 
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